wwh1004 46 Posted June 23, 2019 Share Posted June 23, 2019 (edited) I once post it in a China forum, you can visit it in https://www.52pojie.cn/thread-762832-1-1.html by Google Translator I try my best to introduce it using English 1. download x64dbg and download the symbol file of clr.dll (mscorwks.dll if runtime is .net2.0~.net3.5) 2.set a breakpoint at "SystemDomain::ExecuteMainMethod" in clr.dll/mscorwks.dll and run 3.use MegaDumper (I use my ExtremeDumper based on codecracker's megadumper https://github.com/wwh1004/ExtremeDumper) to dump the main module when the program break at "SystemDomain::ExecuteMainMethod" 4.fix pe header and maybe you shoud also fix .net header This way is more complex than use MegaDumper only and directt dump the assembly. But if the assembly is packed with native stub and protected with anti dump (ConfuserEx and others) or protected with whole #US encryption (DNGuardHVM and others), maybe this way is good to dump assemblies. If you can not understand it, you can reply me. Best wish. Edited June 23, 2019 by wwh1004 (see edit history) 6 1 Link to post
Keosoft90 0 Posted June 23, 2019 Share Posted June 23, 2019 @wwh1004 : can you add 2 tools to here ? Link to post
wwh1004 46 Posted June 23, 2019 Author Share Posted June 23, 2019 4 hours ago, Keosoft90 said: @wwh1004 : can you add 2 tools to here ? https://github.com/x64dbg/x64dbg/releases https://github.com/wwh1004/ExtremeDumper/releases 3 Link to post
BlackHat 70 Posted June 23, 2019 Share Posted June 23, 2019 There is a Script of OLLYDBG made by @GIV that also helps to unpack the Anti Dump protected .NET Files and newbie Friendly too. But this method I tested and works well which you described. Very nice Explanation too. Thank you !!! Link to post
mdj 21 Posted June 25, 2019 Share Posted June 25, 2019 (edited) @wwh1004 please share video on other server i cannot download from pan.baidu Edited June 25, 2019 by mdj (see edit history) Link to post
kao 2,161 Posted June 25, 2019 Share Posted June 25, 2019 @mdj: 使用x64dbg暴打非托管强壳.mp4 -> https://mega.nz/#!Y5JBTaCS!hJXzN5ssvUyRHW8VgpGxINEVrW1zJ2Up96vqqJVG5co I can upload the second video tomorrow, if you need that too. @all: Please be nice and don't abuse the link, it is a free Mega account and has traffic limitations. 4 2 Link to post
mdj 21 Posted June 26, 2019 Share Posted June 26, 2019 @kao thank you very very much for this if you have time please upload second video Best Regards Link to post
kao 2,161 Posted June 26, 2019 Share Posted June 26, 2019 [.NET]实战UnpackMe.mp4 -> https://mega.nz/#!YxwQSAxA!Lwd9XStVyue8fdYKZXmYkoDxE0Y7ftsyNYtBKLTRrGM 4 2 Link to post
john fast 0 Posted April 20, 2020 Share Posted April 20, 2020 @kao can you provide me assembly rebuilder? Link to post
john fast 0 Posted April 20, 2020 Share Posted April 20, 2020 @wwh1004 52pojie.cn asking for Account registration code: Can you provide me invitation link or create new account 😅 Link to post
Sangavi 25 Posted April 20, 2020 Share Posted April 20, 2020 2 hours ago, john fast said: @wwh1004 52pojie.cn asking for Account registration code: Can you provide me invitation link or create new account 😅 I believe they charge for giving out the invitation codes (it is not free of cost) as far as I remember. Link to post
Prab 11 Posted April 21, 2020 Share Posted April 21, 2020 This might help https://github.com/ZrCulillo/JIT-Freezer Link to post
thanhthuanbui0610@gmail.co 0 Posted August 23, 2020 Share Posted August 23, 2020 Hey all bro, i can unpacking Net ProtectIOv 2.0, i need someone to help, create de4dot or Net Protect IO unpacked, i will repurchase that product, who can do it contact me by email: Williamborowsky@artlover.com Link to post
tungtruong20xx 0 Posted September 3, 2020 Share Posted September 3, 2020 On 8/23/2020 at 2:55 PM, thanhthuanbui0610@gmail.co said: Hey all bro, i can unpacking Net ProtectIOv 2.0, i need someone to help, create de4dot or Net Protect IO unpacked, i will repurchase that product, who can do it contact me by email: Williamborowsky@artlover.com tui unpack đc runtime.dll rồi. giờ k biết làm sao để dịch ra code hết Link to post
huynhchicong91 0 Posted September 14, 2020 Share Posted September 14, 2020 On 9/3/2020 at 11:49 PM, tungtruong20xx said: tui unpack đc runtime.dll rồi. giờ k biết làm sao để dịch ra code hết bạn unpack dc netprotect v1.0 ko ? Link to post
namcuong 0 Posted October 2, 2020 Share Posted October 2, 2020 On 9/3/2020 at 11:49 PM, tungtruong20xx said: tui unpack đc runtime.dll rồi. giờ k biết làm sao để dịch ra code hết xin file unpack được không bạn Link to post
Buddyboss 0 Posted November 23, 2020 Share Posted November 23, 2020 Please Get me the file of module to assembly by code cracker🤝, Would be a good help. Link to post
goro1988 0 Posted November 24, 2020 Share Posted November 24, 2020 @wwh1004 Hello brother, my most cordial, affection, would you be so kind, to share the link of your tool, [.NET] AssemblyRebuilder v1.2.2.0 by Wwh, since I did not see it in pan.baidu, and it was removed from github, yes It is not a problem, could you send me a link where to download it Link to post
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now